aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README.md2
-rw-r--r--etc/inc/disable-programs.inc6
-rw-r--r--etc/profile-a-l/lifeograph.profile58
-rw-r--r--etc/profile-m-z/io.github.lainsce.Notejot.profile61
-rw-r--r--etc/profile-m-z/rednotebook.profile67
-rw-r--r--etc/profile-m-z/zim.profile72
-rw-r--r--src/firecfg/firecfg.config22
7 files changed, 279 insertions, 9 deletions
diff --git a/README.md b/README.md
index c635bf811..2fd8e3009 100644
--- a/README.md
+++ b/README.md
@@ -236,3 +236,5 @@ $ ./profstats *.profile
236``` 236```
237 237
238### New profiles: 238### New profiles:
239
240clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 5fe2f8c28..afc65e01b 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -449,6 +449,7 @@ deny ${HOME}/.config/youtube-music-desktop-app
449deny ${HOME}/.config/youtube-viewer 449deny ${HOME}/.config/youtube-viewer
450deny ${HOME}/.config/youtubemusic-nativefier-040164 450deny ${HOME}/.config/youtubemusic-nativefier-040164
451deny ${HOME}/.config/zathura 451deny ${HOME}/.config/zathura
452deny ${HOME}/.config/zim
452deny ${HOME}/.config/zoomus.conf 453deny ${HOME}/.config/zoomus.conf
453deny ${HOME}/.conkeror.mozdev.org 454deny ${HOME}/.conkeror.mozdev.org
454deny ${HOME}/.crawl 455deny ${HOME}/.crawl
@@ -684,6 +685,7 @@ deny ${HOME}/.local/share/godot
684deny ${HOME}/.local/share/gradio 685deny ${HOME}/.local/share/gradio
685deny ${HOME}/.local/share/gwenview 686deny ${HOME}/.local/share/gwenview
686deny ${HOME}/.local/share/i2p 687deny ${HOME}/.local/share/i2p
688deny ${HOME}/.local/share/io.github.lainsce.Notejot
687deny ${HOME}/.local/share/jami 689deny ${HOME}/.local/share/jami
688deny ${HOME}/.local/share/kaffeine 690deny ${HOME}/.local/share/kaffeine
689deny ${HOME}/.local/share/kalgebra 691deny ${HOME}/.local/share/kalgebra
@@ -840,6 +842,7 @@ deny ${HOME}/.qgis2
840deny ${HOME}/.qmmp 842deny ${HOME}/.qmmp
841deny ${HOME}/.quodlibet 843deny ${HOME}/.quodlibet
842deny ${HOME}/.redeclipse 844deny ${HOME}/.redeclipse
845deny ${HOME}/.rednotebook
843deny ${HOME}/.remmina 846deny ${HOME}/.remmina
844deny ${HOME}/.repo_.gitconfig.json 847deny ${HOME}/.repo_.gitconfig.json
845deny ${HOME}/.repoconfig 848deny ${HOME}/.repoconfig
@@ -1010,6 +1013,7 @@ deny ${HOME}/.cache/gummi
1010deny ${HOME}/.cache/icedove 1013deny ${HOME}/.cache/icedove
1011deny ${HOME}/.cache/inkscape 1014deny ${HOME}/.cache/inkscape
1012deny ${HOME}/.cache/inox 1015deny ${HOME}/.cache/inox
1016deny ${HOME}/.cache/io.github.lainsce.Notejot
1013deny ${HOME}/.cache/iridium 1017deny ${HOME}/.cache/iridium
1014deny ${HOME}/.cache/JetBrains/CLion* 1018deny ${HOME}/.cache/JetBrains/CLion*
1015deny ${HOME}/.cache/kcmshell5 1019deny ${HOME}/.cache/kcmshell5
@@ -1066,6 +1070,7 @@ deny ${HOME}/.cache/qBittorrent
1066deny ${HOME}/.cache/quodlibet 1070deny ${HOME}/.cache/quodlibet
1067deny ${HOME}/.cache/qupzilla 1071deny ${HOME}/.cache/qupzilla
1068deny ${HOME}/.cache/qutebrowser 1072deny ${HOME}/.cache/qutebrowser
1073deny ${HOME}/.cache/rednotebook
1069deny ${HOME}/.cache/rhythmbox 1074deny ${HOME}/.cache/rhythmbox
1070deny ${HOME}/.cache/shotwell 1075deny ${HOME}/.cache/shotwell
1071deny ${HOME}/.cache/simple-scan 1076deny ${HOME}/.cache/simple-scan
@@ -1096,3 +1101,4 @@ deny ${HOME}/.cache/yandex-browser
1096deny ${HOME}/.cache/yandex-browser-beta 1101deny ${HOME}/.cache/yandex-browser-beta
1097deny ${HOME}/.cache/youtube-dl 1102deny ${HOME}/.cache/youtube-dl
1098deny ${HOME}/.cache/youtube-viewer 1103deny ${HOME}/.cache/youtube-viewer
1104deny ${HOME}/.cache/zim
diff --git a/etc/profile-a-l/lifeograph.profile b/etc/profile-a-l/lifeograph.profile
new file mode 100644
index 000000000..b9ed0de8e
--- /dev/null
+++ b/etc/profile-a-l/lifeograph.profile
@@ -0,0 +1,58 @@
1# Firejail profile for lifeograph
2# Description: Lifeograph is a diary program to take personal notes
3# This file is overwritten after every install/update
4# Persistent local customizations
5include lifeograph.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${DOCUMENTS}
10
11deny /usr/libexec
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-xdg.inc
21
22allow ${DOCUMENTS}
23allow /usr/share/lifeograph
24include whitelist-common.inc
25include whitelist-runuser-common.inc
26include whitelist-usr-share-common.inc
27include whitelist-var-common.inc
28
29apparmor
30caps.drop all
31machine-id
32net none
33no3d
34nodvd
35nogroups
36noinput
37nonewprivs
38noroot
39nosound
40notv
41nou2f
42novideo
43protocol unix
44seccomp
45seccomp.block-secondary
46shell none
47tracelog
48
49disable-mnt
50private-bin lifeograph
51private-cache
52private-dev
53private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
54private-tmp
55
56dbus-user filter
57dbus-user.talk ca.desrt.dconf
58dbus-system none
diff --git a/etc/profile-m-z/io.github.lainsce.Notejot.profile b/etc/profile-m-z/io.github.lainsce.Notejot.profile
new file mode 100644
index 000000000..a8029db72
--- /dev/null
+++ b/etc/profile-m-z/io.github.lainsce.Notejot.profile
@@ -0,0 +1,61 @@
1# Firejail profile for notejot
2# Description: Jot your ideas
3# This file is overwritten after every install/update
4# Persistent local customizations
5include io.github.lainsce.Notejot.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/io.github.lainsce.Notejot
10nodeny ${HOME}/.local/share/io.github.lainsce.Notejot
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-xdg.inc
20
21mkdir ${HOME}/.cache/io.github.lainsce.Notejot
22mkdir ${HOME}/.local/share/io.github.lainsce.Notejot
23allow ${HOME}/.cache/io.github.lainsce.Notejot
24allow ${HOME}/.local/share/io.github.lainsce.Notejot
25allow /usr/libexec/webkit2gtk-4.0
26include whitelist-common.inc
27include whitelist-runuser-common.inc
28include whitelist-usr-share-common.inc
29include whitelist-var-common.inc
30
31apparmor
32caps.drop all
33machine-id
34net none
35no3d
36nodvd
37nogroups
38noinput
39nonewprivs
40noroot
41nosound
42notv
43nou2f
44novideo
45protocol unix
46seccomp
47seccomp.block-secondary
48shell none
49tracelog
50
51disable-mnt
52private-bin io.github.lainsce.Notejot
53private-cache
54private-dev
55private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
56private-tmp
57
58dbus-user filter
59dbus-user.own io.github.lainsce.Notejot
60dbus-user.talk ca.desrt.dconf
61dbus-system none
diff --git a/etc/profile-m-z/rednotebook.profile b/etc/profile-m-z/rednotebook.profile
new file mode 100644
index 000000000..67281c518
--- /dev/null
+++ b/etc/profile-m-z/rednotebook.profile
@@ -0,0 +1,67 @@
1# Firejail profile for rednotebook
2# Description: Daily journal with calendar, templates and keyword searching
3# This file is overwritten after every install/update
4# Persistent local customizations
5include rednotebook.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/rednotebook
10nodeny ${HOME}/.rednotebook
11
12# Allow python (blacklisted by disable-interpreters.inc)
13include allow-python3.inc
14
15include disable-common.inc
16include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-passwdmgr.inc
20include disable-programs.inc
21include disable-shell.inc
22
23mkdir ${HOME}/.cache/rednotebook
24mkdir ${HOME}/.rednotebook
25allow ${HOME}/.cache/rednotebook
26allow ${HOME}/.rednotebook
27allow ${DESKTOP}
28allow ${DOCUMENTS}
29allow ${DOWNLOADS}
30allow ${MUSIC}
31allow ${PICTURES}
32allow ${VIDEOS}
33allow /usr/libexec/webkit2gtk-4.0
34include whitelist-common.inc
35include whitelist-runuser-common.inc
36include whitelist-usr-share-common.inc
37include whitelist-var-common.inc
38
39apparmor
40caps.drop all
41machine-id
42net none
43no3d
44nodvd
45nogroups
46noinput
47nonewprivs
48noroot
49nosound
50notv
51nou2f
52novideo
53protocol unix
54seccomp
55seccomp.block-secondary
56shell none
57tracelog
58
59disable-mnt
60private-bin python3*,rednotebook
61private-cache
62private-dev
63private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
64private-tmp
65
66dbus-user none
67dbus-system none
diff --git a/etc/profile-m-z/zim.profile b/etc/profile-m-z/zim.profile
new file mode 100644
index 000000000..5ae9cddb3
--- /dev/null
+++ b/etc/profile-m-z/zim.profile
@@ -0,0 +1,72 @@
1# Firejail profile for Zim
2# Description: Desktop wiki & notekeeper
3# This file is overwritten after every install/update
4# Persistent local customizations
5include zim.local
6# Persistent global definitions
7include globals.local
8
9nodeny ${HOME}/.cache/zim
10nodeny ${HOME}/.config/zim
11
12# Allow python (blacklisted by disable-interpreters.inc)
13include allow-python2.inc
14include allow-python3.inc
15
16deny /usr/libexec
17
18include disable-common.inc
19include disable-devel.inc
20include disable-exec.inc
21include disable-interpreters.inc
22include disable-passwdmgr.inc
23include disable-programs.inc
24include disable-shell.inc
25
26mkdir ${HOME}/.cache/zim
27mkdir ${HOME}/.config/zim
28mkdir ${HOME}/Notebooks
29allow ${HOME}/.cache/zim
30allow ${HOME}/.config/zim
31allow ${HOME}/Notebooks
32allow ${DESKTOP}
33allow ${DOCUMENTS}
34allow ${DOWNLOADS}
35allow ${MUSIC}
36allow ${PICTURES}
37allow ${VIDEOS}
38allow /usr/share/zim
39include whitelist-common.inc
40include whitelist-runuser-common.inc
41include whitelist-usr-share-common.inc
42include whitelist-var-common.inc
43
44apparmor
45caps.drop all
46machine-id
47net none
48no3d
49nodvd
50nogroups
51noinput
52nonewprivs
53noroot
54nosound
55notv
56nou2f
57novideo
58protocol unix
59seccomp
60seccomp.block-secondary
61shell none
62tracelog
63
64disable-mnt
65private-bin python*,zim
66private-cache
67private-dev
68private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11
69private-tmp
70
71dbus-user none
72dbus-system none
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 7052f7509..dd422e651 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -45,8 +45,8 @@ amule
45amuled 45amuled
46android-studio 46android-studio
47anydesk 47anydesk
48apostrophe
49apktool 48apktool
49apostrophe
50# ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) 50# ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
51arch-audit 51arch-audit
52archaudit-report 52archaudit-report
@@ -143,8 +143,8 @@ clawsker
143clementine 143clementine
144clion 144clion
145clion-eap 145clion-eap
146clipit
147clipgrab 146clipgrab
147clipit
148cliqz 148cliqz
149clocks 149clocks
150cmus 150cmus
@@ -168,6 +168,7 @@ crow
168cryptocat 168cryptocat
169cvlc 169cvlc
170cyberfox 170cyberfox
171d-feet
171darktable 172darktable
172dconf-editor 173dconf-editor
173ddgr 174ddgr
@@ -198,13 +199,12 @@ dragon
198drawio 199drawio
199drill 200drill
200dropbox 201dropbox
201d-feet
202easystroke 202easystroke
203ebook-viewer
204ebook-convert 203ebook-convert
205ebook-edit 204ebook-edit
206ebook-meta 205ebook-meta
207ebook-polish 206ebook-polish
207ebook-viewer
208electron-mail 208electron-mail
209electrum 209electrum
210element-desktop 210element-desktop
@@ -295,8 +295,8 @@ gimp-2.10
295gimp-2.8 295gimp-2.8
296gist 296gist
297gist-paste 297gist-paste
298gitg
299git-cola 298git-cola
299gitg
300github-desktop 300github-desktop
301gitter 301gitter
302# gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 302# gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102
@@ -387,14 +387,15 @@ icecat
387icedove 387icedove
388iceweasel 388iceweasel
389idea 389idea
390ideaIC
391idea.sh 390idea.sh
391ideaIC
392imagej 392imagej
393img2txt 393img2txt
394impressive 394impressive
395inkscape 395inkscape
396inkview 396inkview
397inox 397inox
398io.github.lainsce.Notejot
398ipcalc 399ipcalc
399ipcalc-ng 400ipcalc-ng
400iridium 401iridium
@@ -453,6 +454,7 @@ librecad
453libreoffice 454libreoffice
454librewolf 455librewolf
455librewolf-nightly 456librewolf-nightly
457lifeograph
456liferea 458liferea
457lightsoff 459lightsoff
458lincity-ng 460lincity-ng
@@ -524,7 +526,6 @@ mp3splt-gtk
524mp3wrap 526mp3wrap
525mpDris2 527mpDris2
526mpg123 528mpg123
527mpg123.bin
528mpg123-alsa 529mpg123-alsa
529mpg123-id3dump 530mpg123-id3dump
530mpg123-jack 531mpg123-jack
@@ -534,6 +535,7 @@ mpg123-oss
534mpg123-portaudio 535mpg123-portaudio
535mpg123-pulse 536mpg123-pulse
536mpg123-strip 537mpg123-strip
538mpg123.bin
537mplayer 539mplayer
538mpsyt 540mpsyt
539mpv 541mpv
@@ -675,6 +677,7 @@ qupzilla
675qutebrowser 677qutebrowser
676rambox 678rambox
677redeclipse 679redeclipse
680rednotebook
678redshift 681redshift
679regextester 682regextester
680remmina 683remmina
@@ -735,8 +738,8 @@ steam
735steam-native 738steam-native
736steam-runtime 739steam-runtime
737stellarium 740stellarium
738strawberry
739straw-viewer 741straw-viewer
742strawberry
740strings 743strings
741studio.sh 744studio.sh
742subdownloader 745subdownloader
@@ -863,10 +866,10 @@ wire-desktop
863wireshark 866wireshark
864wireshark-gtk 867wireshark-gtk
865wireshark-qt 868wireshark-qt
869wordwarvi
866wpp 870wpp
867wps 871wps
868wpspdf 872wpspdf
869wordwarvi
870x2goclient 873x2goclient
871xbill 874xbill
872xcalc 875xcalc
@@ -908,6 +911,7 @@ zaproxy
908zart 911zart
909zathura 912zathura
910zeal 913zeal
914zim
911zoom 915zoom
912# zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) 916# zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
913# zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) 917# zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 14:43:17 +0000